CVE-2023-53474 x86/MCE/AMD: Use an u64 for bank_map
An integer overflow in the Linux kernel AMD MCE driver causes a shift-out-of-bounds error, potentially leading to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53474?
CVE-2023-53474 is a high-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/MCE/AMD: Use an u64 for bank_map
Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see
a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64").
However, the bank_map which contains a bitfield of which banks to initialize is of type unsigned int and that overflows when those bit numbers are >= 32, leading to UBSAN complaining correctly:
UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 shift exponent 32 is too large for 32-bit type 'int'
Change the bank_map to a u64 and use the proper BIT_ULL() macro when modifying bits in there.
[ bp: Rewrite commit message. ]
Weakness: CWE-190
Which versions are affected by CVE-2023-53474?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53474?
Apply the vendor's patch.
Is CVE-2023-53474 being exploited?
There is no known exploitation of CVE-2023-53474 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53474, DEBIAN-CVE-2023-53474, GHSA-hv7j-2x22-hrmc, UBUNTU-CVE-2023-53474.